fix(desktop): upgrade Clerk OAuth transport

[t3dotgg]

Clerk JS 6.25.13 preserves a page-derived redirectUrlComplete during native OAuth. When an in-modal sign-in transfers to sign-up, Clerk navigates the Electron renderer to CLERK-ROUTER/VIRTUAL/sign-up#/continue and the T3 hash router shows Not Found.

Upgrade the coherent Clerk package set to Electron 0.0.33 and Clerk JS 6.29.2. This includes clerk/javascript#9370, which replaces both native OAuth redirect URLs with the registered transport callback and keeps intermediate steps inside the Clerk component router. No T3 routing workaround is included.

Tests:

• focused Clerk web and desktop tests
• web, desktop, mobile, and relay typechecks
• installed native transport verification
• targeted format and diff checks

Model: GPT-5.6 Sol | Harness: Codex in T3 Code

Note

Upgrade Clerk OAuth transport packages in desktop workspace

Updates @clerk/clerk-js, @clerk/electron, @clerk/react, and @clerk/shared to their latest versions in pnpm-workspace.yaml, along with matching minimumReleaseAgeExclude entries. This targets a fix in Clerk's OAuth transport layer for the desktop app.

^{Macroscope summarized 99e1de6.}

---

Note

Medium Risk
Dependency-only change but touches authentication SDKs used on web and Electron; regression risk is in sign-in/OAuth flows rather than application logic in this diff.

Overview
Bumps pinned Clerk versions in the workspace catalog, overrides, and minimumReleaseAgeExclude, with matching pnpm-lock.yaml resolution updates.

@clerk/electron moves 0.0.24 → 0.0.33; @clerk/react 6.12.10 → 6.14.4; @clerk/clerk-js 6.25.13 → 6.29.2; @clerk/shared 4.25.10 → 4.29.2. @clerk/backend stays at 3.14.0. apps/desktop and apps/web lockfile entries for @clerk/electron and @clerk/react follow the new versions.

^{Reviewed by Cursor Bugbot for commit 99e1de6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ef804006-a32b-4b7d-97b5-8bea8ec98957

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved at 99e1de6

Macroscope's review found this PR approvable — This PR contains only mechanical version bumps for Clerk packages in the pnpm workspace catalog. No code logic changes, just dependency version updates for routine maintenance.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+17 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+15 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	+14 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+12 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 36f4314 · PR result: 99e1de6 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.